Error 42102 [Exception in Macro Viruses Code] during boot scan

[ADP_AVAST_01]

Hello, today i ran a boot scan, as i do every two weeks, and i saw that alongside the common, that i get every time since years, [Zip Archive is Corrupted] and a PDF file that is registred as a [Decompression Bomb], i got something new that worry me a little.

I saw that i had 4 files that were registered as "Error 42102 [Exception in Macro Viruses Code]".

What is Error 42102 ? is it a common Error ? Should i worry ?

And how to fix this error if it can be fixed ?

I ran the latest version of Avast Antivirus Free version. (I updated to the latest version 20.10.5824.618, yesterday.)



Your help is welcome, and in advance i offer my thanks to whoever will help solving this problem. 

[igor]

Can you please attach the file C:\ProgramData\AVAST Software\Avast\log\aswBoot.log ?
Thanks.

[ADP_AVAST_01]

Here is the Boot file you requested, i hope it will help solving this problem.

Do you need the aswBoot.txt as well ?

Thanks for your help. 


Edit :

Also, after reading the aswBoot.txt file, i figured that my last boot scan was only a week ago^^ (05/12/2020), but also, more importantly, that this problem became apparent since this scan last week. For information, all scan before the 27/11/2020 did not have those errors.

Plus, if it can help, here are the problematics files as they appeared during both the previous and the today scan boot :

05/12 - Boot Scan :
Fichier C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Word_16051.13328.20356.0_x86__8wekyb3d8bbwe\Office16\2052\ClgrFont\HYC7GFM.TTF|>:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~19041.508.1.9\wow64_microsoft-windows-m..nts-mdac-rds-ce-dll_31bf3856ad364e35_10.0.19041.329_none_4a5782cfd4dc55fd.manifest Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\System32\policymanager.dll|>:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\WinSxS\amd64_microsoft-windows-rasifmon_31bf3856ad364e35_10.0.19041.1_none_80c0d7568c8c0652\ifmon.dll:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}

13/12 Boot Scan :
Fichier C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Publisher_16051.13426.20308.0_x86__8wekyb3d8bbwe\.pkg\pubs-102.targetsize-96.png Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~19041.630.1.6\microsoft-hyper-v-clientedition-package~31bf3856ad364e35~amd64~et-ee~10.0.19041.488.cat|>:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\System32\CoreShell.dll|>:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}
Fichier C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.630_none_8622d423ee015f19\MsSense.exe|>:WofCompressedData Erreur 42102 {Exception dans le virus de macro.}

I don't know if it matters, but it appear that while the number of file did not change (4 are concerned), they are also different in some ways.

With the hope this additional bit of text may help solve the problem. =)

Thanks. 

[igor]

Hmm, I was hoping to be able to reproduce it (if needed, after getting the affected files from you) - but if you say it occurs on different files each run, then I admit I'm not sure what to do...
I tried with a few of the files from the second batch... but no error here. It might be related to some different files (processed earlier during the scan) and the error appears randomly later.

Generally the new error is not something you should be worried about (meaning, it doesn't imply anything malicious), but it basically means a piece of code responsible to the scanning crashed - which I certainly don't like.

[ADP_AVAST_01]

Thanks for your answer and your hard work igor. 

So far, with the limited knowledge that i possess and your answer, i have to understand that there is nothing "malicious" behind those errors and that they happened due to a piece of code in the avast scan engine that "malfunction" during the boot scan ?

While i don't know if it may help you find the cause of this error, but while the files are differents, their origins seems to remains the same so far:

- Fichier C:\Program Files\WindowsApps\Microsoft.Office
- Fichier C:\Windows\servicing\LCU\Package_for_RollupFix
- Fichier C:\Windows\System32
- Fichier C:\Windows\WinSxS\amd64

To note, that the boot scan did proceed normally and appears to have completed themselves at 100 % each time, and so far, i encountered no crash of any sort, from either my computer or Avast, plus as you may have seen with the aswBoot.log file, each scan ended up clean of any infection, with 0 infected files. The only thing that i have noted was that the scan appeared a little shorter than it normally was before, perhaps 10-15 minutes shorter, but that may also simply be an impression from me.

Again thank you for your answer and hard work. 

[igor]

I added some more logging that might tell me a bit more (no guarantee though). So if the errors still appear for you, can you please try the following:
1. Make sure you've got the latest virus definitions (Settings / Update / Virus definitions - Check for updates)
2. Enable debug logging - Settings / Troubleshooting / Enable debug logging (checkbox near the bottom of the page)
3. Schedule the boot-time scan
4. Now you can uncheck the "Enable debug logging" option again, it's consulted during the scheduling operation. If you leave it on, some other log files may get unnecessarily big.
5. Let the boot-time scan run (i.e. restart the machine)
6. Attach the resulting C:\ProgramData\AVAST Software\Avast\log\aswBoot.log file (assuming the errors appeared again).
Thanks.

[ADP_AVAST_01]

Hello, and thank you for your answer.

So, first, the problem did not disappear since last time, and for a couple of weeks it remained unchanged, and still is present, with a little change that i witnessed today...

Today i performed my weekly boot scan, and i encountered this new message for each problematic entries :

Error 0xC0000005 "L'instruction à 0x%p emploie l'adresse mémoire 0x%p. l'état de la mémoire ne peut pas être %s."

Fortunately i though to capture the screenshot with my phone, because, as i guessed this error did not appear in the aswboot.txt file.

So right after, i checked on the forum, and saw your answer, and since i got the time, a few hours later, following your instructions, i ran a second boot scan, and encountered the same problem.

To note, that the only update i remember performing since my last boot scan a week ago the 10/01/2021, was a windows update, and i don't remember updating any other software.

So, in the end, i'm joining to this message the aswBoot.log file, plus the two screenshot that i took during the two boot scans that i ran today.

I add, that to this day, whatever the source of the problem it had no consequences so far on my every day use of the computer, that's the only good news that i have when facing this problem....but the problem remains.

I'm considering unistalling and reinstalling Avast to see if the problem remains, but i will be waiting for your advices before experimenting this.

I hope that my problem does have a solution and that it may help to improve Avast. =)

Again, thank you for your answers and your hard work. =)

[igor]

I think I found the problem, thanks to the extended log.
The fix should be released tomorrow for the beta versions (via a virus definition update), and for everyone soon after that. So let's hope the errors disappear within the next few days.

[ADP_AVAST_01]

Hello and thank you for your answer and the effort you put into solving this bug.

I plan to do a boot scan at the end of this week or monday, and like the last one, i will do it following your previous instruction, so if the problem persist i may be able to provide you with an extended log. Of course i will also inform you if the problem is effectively solved thanks to the fix. =)

Once again, i thanks you for your answers and your hard work. =)

[ADP_AVAST_01]

Hello,

Good News, problem solved.

Today, i performed a boot scan, and it appears that the fix worked, because there are no longer any errors 42102. Everything is back to normal.

Thank you for the hardwork you put into solving this problem. =)



(In case you would need it for technical reasons, i joint to this post the extended .log file of today boot scan.)

[igor]

Thanks for the confirmation!